Added support for argon2, more secure than sha256 with salt.

Kept backwards compat with existing stored keys.

server/requirements.txt

@@ -50,3 +50,4 @@ art
 dnspython
 aiohttp
 uvloop
+argon2-cffi

server/src/uds/core/managers/crypto.py

@@ -41,6 +41,8 @@ import logging
 import typing
 import secrets
 
+# For password secrets
+from argon2 import PasswordHasher
 
 from cryptography import x509
 from cryptography.hazmat.backends import default_backend
@@ -263,10 +265,8 @@ class CryptoManager(metaclass=singleton.Singleton):
         if isinstance(value, str):
             value = value.encode()
 
-        salt = self.salt(8)  # 8 bytes = 16 chars
-        value = salt.encode() + value
-
-        return '{SHA256SALT}' + salt + str(hashlib.sha3_256(value).hexdigest())
+        # Argon2
+        return '{ARGON2}' + PasswordHasher().hash(value.decode())
 
     def checkHash(self, value: typing.Union[str, bytes], hashValue: str) -> bool:
         if isinstance(value, str):
@@ -287,6 +287,15 @@ class CryptoManager(metaclass=singleton.Singleton):
                 hashlib.sha3_256(value).hexdigest(), hashValue[28:]
             )
 
+        # Argon2
+        if hashValue[:8] == '{ARGON2}':
+            ph = PasswordHasher()
+            try:
+                ph.verify(hashValue[8:], value.decode())
+                return True
+            except Exception:
+                return False  # Verify will raise an exception if not valid
+
         # Old sha1
         return secrets.compare_digest(
             hashValue, str(hashlib.sha1(value).hexdigest())  # nosec: Old compatibility SHA1, not used anymore but need to be supported